Description
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(), and Remote::post(), to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters in a header value to inject a separate unintended request header to the remote service. This issue is fixed in versions 4.9.4 and 5.4.4.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
getkirby kirby
< 4.9.4affected>= 5.0.0, < 5.4.4affected
References
- https://github.com/getkirby/kirby/security/advisories/GHSA-4v4h-m2qq-ppgw ↗
- https://github.com/getkirby/kirby/commit/aa33414e1669e866cdd6f4decfae2a669e8bb828 ↗
- https://github.com/getkirby/kirby/commit/fad9cbd22c73ed0fbd3aaf62310a8dcacfc007cd ↗
- https://github.com/getkirby/kirby/releases/tag/4.9.4 ↗
- https://github.com/getkirby/kirby/releases/tag/5.4.4 ↗